Skip to content

Aws::CloudFront::Signer SHA1 digest is not supported on Fedora Linux #3313

Closed
#3426
Closed
Aws::CloudFront::Signer SHA1 digest is not supported on Fedora Linux#3313
#3426
Labels
cross-sdkA feature that requires cross-sdk discussion.feature-requestA feature should be added or improved.

Description

@jdufresne
jdufresne
opened on Oct 29, 2025

Describe the bug

The Aws::CloudFront::Signer class always uses the digest algorithm "SHA1",

aws-sdk-ruby/gems/aws-sdk-cloudfront/lib/aws-sdk-cloudfront/signer.rb

Line 16 in 3919bcc

@cipher = OpenSSL::Digest.new('SHA1')

But this digest algorithm is unsupported since Fedora 41:

https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer

When using Aws::CloudFront::Signer on Fedora, it results in:

OpenSSL::PKey::PKeyError (EVP_DigestSignInit: invalid digest):

Changing the digest to SHA256 works for me, either by patching the aws-sdk-cloudfront gem or by overriding the class.

 @cipher = OpenSSL::Digest.new('SHA256')

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

Aws::CloudFront::Signer is compatible with a default Fedora installation without any monkey patching.

Current Behavior

Results in the error:

OpenSSL::PKey::PKeyError (EVP_DigestSignInit: invalid digest):

Reproduction Steps

Using Fedora Linux:

require 'aws-sdk-cloudfront'

signer = Aws::CloudFront::UrlSigner.new(key_pair_id: 'MY_KEY_PAIR_ID', private_key_path: '/home/jon/private.pem')
signed_url = signer.signed_url('https://mydistribution.cloudfront.net/myvideo.mp4', expires: Time.now.to_i + 3600)
puts signed_url
.../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:98:in 'OpenSSL::PKey::PKey#sign': EVP_DigestSignInit: invalid digest (OpenSSL::PKey::PKeyError)
	from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:98:in 'Aws::CloudFront::Signer#sign_policy'
	from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/signer.rb:91:in 'Aws::CloudFront::Signer#signature'
	from .../vendor/bundle/ruby/3.4.0/gems/aws-sdk-cloudfront-1.132.0/lib/aws-sdk-cloudfront/url_signer.rb:30:in 'Aws::CloudFront::UrlSigner#signed_url'
	from test.rb:4:in '<main>'

Possible Solution

require 'aws-sdk-cloudfront'

class MyUrlSigner < Aws::CloudFront::UrlSigner
  def initialize(...)
    super
    @cipher = OpenSSL::Digest.new('SHA256')
  end
end

signer = MyUrlSigner.new(key_pair_id: 'MY_KEY_PAIR_ID', private_key_path: '/home/jon/private.pem')
signed_url = signer.signed_url('https://mydistribution.cloudfront.net/myvideo.mp4', expires: Time.now.to_i + 3600)
puts signed_url

Additional Information/Context

No response

Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version

aws-sdk-cloudfront

Environment details (Version of Ruby, OS environment)

Fedora Linux, ruby 3.4.7 (2025-10-08 revision 7a5688e2a2) +PRISM [x86_64-linux]

Activity

  1. jdufresne
    added
    bugThis issue is a bug.
    needs-triageThis issue or PR still needs to be triaged.
    on Oct 29, 2025
  2. jterapin
    added
    investigatingIssue is being investigated
    and removed
    needs-triageThis issue or PR still needs to be triaged.
    on Oct 29, 2025

  3. jterapin commented on Oct 29, 2025

    @jterapin
    jterapin
    on Oct 29, 2025
    Contributor

    Hi! Thanks for submitting this issue. I found a similar ticket that was reported for AWS SDK for PHP in May 2025: aws/aws-sdk-php#3116

    It's interesting that SHA256 appears to work with CloudFront despite not being documented as supported. Please continue using the monkey patch for now. I'll need to verify with the service team on this and will follow up here.

  4. jdufresne commented on Nov 4, 2025

    @jdufresne
    jdufresne
    on Nov 4, 2025
    Author

    I found another workaround that may be more useful for anyone looking for a solution, first export the environment variable:

    export OPENSSL_ENABLE_SHA1_SIGNATURES=1

    https://fedoraproject.org/wiki/SHA1SignaturesGuidance

    For package builds, you can export the OPENSSL_ENABLE_SHA1_SIGNATURES environment variable. Its value doesn't matter, the code only checks for its presence. Note that this environment variable is explicitly unsupported at runtime, and we're going to remove it without forewarning in a future version of OpenSSL on Fedora.

    Don't use this environment variable to work around problems at runtime.

  5. jterapin commented on Nov 11, 2025

    @jterapin
    jterapin
    on Nov 11, 2025
    Contributor

    Following up on this. Which key (RSA or ECDSA) were you using for the above?

  6. jdufresne commented on Nov 11, 2025

    @jdufresne
    jdufresne
    on Nov 11, 2025
    Author

    Following up on this. Which key (RSA or ECDSA) were you using for the above?

    I was using RSA, thanks.

  7. jterapin
    added
    feature-requestA feature should be added or improved.
    queued
    and removed
    investigatingIssue is being investigated
    bugThis issue is a bug.
    on May 29, 2026

  8. jterapin commented on May 29, 2026

    @jterapin
    jterapin
    on May 29, 2026
    Contributor

    Thank you for your patience on this. CloudFront launched SHA-256 support for signed URLs in April 2026, so we're now able to address this on the SDK side. We're re-categorizing this as a feature request and tracking the implementation internally.

    We don't have a timeline to share yet as we're aligning on the implementation approach, but I'll circle back here once we're aligned and have an update.

  9. jterapin
    added
    cross-sdkA feature that requires cross-sdk discussion.
    and removed
    queued
    on Aug 10, 2026
  10. dscpinheiro
    linked a pull request that will close this issuefeat: Add support for SHA256 in the CloudFront signers #3426on Sep 21, 2026
  11. dscpinheiro
    closed this as completedin #3426on Sep 23, 2026

  12. github-actions commented on Sep 23, 2026

    @github-actions
    github-actionsbot
    on Sep 23, 2026 – with GitHub Actions

    This issue is now closed. Comments on closed issues are hard for our team to see.
    If you need more assistance, please open a new issue that references this one.

  13. dscpinheiro commented on Sep 23, 2026

    @dscpinheiro
    dscpinheiro
    on Sep 23, 2026
    Contributor

    Today's release (https://rubygems.org/gems/aws-sdk-cloudfront) updates the CloudFront signer to accept SHA256 as an option when creating the signed URL or cookie. It's opt-in for backwards compatibility (default is still SHA1), but that should unblock you from using the signer in an environment where SHA1 is not available:

    signer = Aws::CloudFront::UrlSigner.new(
  key_pair_id: 'MY_KEY_PAIR_ID',
  private_key_path: '/path/to/private.pem',
  hash_algorithm: 'SHA256'
)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cross-sdkA feature that requires cross-sdk discussion.feature-requestA feature should be added or improved.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions